MIRE // MULTI-LAYER INTRUSION RESPONSE ENGINE — EVOLUTION, CHAPTER 2

MIRE/Evolution

Six months of the maze growing up. It learned to name intent, fingerprint its visitors, hold them longer — and bill an AI crawler in Bitcoin.

Jan 1 – Jun 30, 2026. Half a year of logs, read as a record of change: new instrumentation, new decoys, deeper delays, and the month two crawlers split 195 GB of fake databases between them through a door that wasn't supposed to be there.

Scroll
The shape of growth

Busier every month.

From 44k trapped requests in January to 469k in June — a roughly ten-fold climb, and with it the attacker time the maze quietly burned.

Trapped requests per month
Attacker time wasted per month (hours)
Instrumentation

The maze learned to write more down.

Chapter one bit hard but recorded little. Over these six months the logging caught up — each date below is the first time a new kind of record appears.

logging, as it evolved — Jan → Jun 2026
Feb 18–19

It started naming what they were after.

Before, a hit was just Request completed /path. In two days that February, the maze began classifying intent — recording not the URL, but the theft it represented. These are the labels it wrote most over the half-year.

The treacle

The holds got longer.

In December nothing was held past nine seconds. On Feb 16 a single request was held for 100.8 seconds — and the average wait climbed every month as the delay engine matured.

Longest single hold per month (seconds)
Average hold per month (seconds)
The June flood

Two crawlers found the demo door.

cfd.mire.cc is a demonstration endpoint — normally kept out of the logs entirely. On June 17 two crawlers found it, each named in its own User-Agent: ClaudeBot and SemrushBot. They began pulling files — so they were fed synthetic 4 MB archives and SQL dumps, each laced with canary tokens, and they split the bill almost evenly.

cfd.mire.cc data served per day — June (GB)

PHASE 1 · JUN 17–30Feed it decoys

    PHASE 2 · FROM JUL 2Just leave a note

      The reply

      A 205-byte invoice.

      Then the same User-Agent match was flipped: instead of a heavy decoy, any crawler that names itself now gets 205 bytes of plain text and a delay — 9,500× less data, still tarpitted. The text they are served, typed out exactly as delivered:

      HTTP 200 · text/plain · 205 bytes · served to AI crawlers
      
      
      
    
      
  
      

  
  
      
    
      
      
      New rooms
      
      
      The floor plan kept expanding.
      
      
      On Apr 1 a wave of new decoy handlers went live — whole new categories of trap, each served and logged on first contact. The maze grew rooms to match whatever scanners were asking for.
      
      
      
        
      
          
      New decoys that went live in this window
      
          
      
        
      
        
      
          
      New request methods handled
      
          
      
          
      
            
      Delay narration, gone
      
            
      December's Simulated delay… lines vanished entirely — zero in six months. The wait no longer narrates itself; it just lives in each request's duration.
      
          
      
        
      
      
      
    
      
  
      

  
  
      
    
      
      
      Closing note
      
      
      From counting bytes to naming intent.
      
      
      Six months on: 1.2 million trapped requests, 209 GB of treacle, 91 days of attacker time. A maze that now fingerprints its visitors, records the theft each probe represents, deepens its holds by the week — and, when two crawlers split 195 GB of fake databases between them, answered each with a 205-byte invoice payable in Bitcoin.
      
      
      "Turn your noise into their cost."
      
      
      Production honeypot. Real data. Jan – Jun 2026.
      
      ← Back to the maze
      
      Lee Mössner